Which versions of akamai-sensorv1 are malicious?

The following npm versions of akamai-sensorv1 are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate akamai-sensorv1 if I installed it?

akamai-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed akamai-sensorv1 — how do I know if it already compromised me?

If akamai-sensorv1 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is akamai-sensorv1 part of a known attack campaign?

Yes — akamai-sensorv1 is associated with the IN-MAL-2026-015801 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find akamai-sensorv1 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for akamai-sensorv1 (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging akamai-sensorv1 across your stack and pipelines.

Malicious package

akamai-sensorv1npm

akamai-sensorv1 is a confirmed malicious npm package (MAL-2026-13216) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in akamai-sensorv1 (npm)

MAL-2026-13216

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall akamai-sensorv1

What this malware does

The package hides an executable payload inside a block comment in index.js using Unicode variation selectors (U+FE00–U+FE0F and U+E0100–U+E01EF). sync-metrics.js reads index.js, extracts that comment, decodes the invisible bytes via unpack(), and executes the resulting string with new Function('require', batch)(require). Extraction and execution are triggered from touch() at the top of the exported sensor() function, so any consumer that calls the advertised API runs the concealed code. In addition, config.json hardcodes a public Google Calendar ICS URL (calendar.google.com/calendar/ical/hev4229%40gmail.com/public/basic.ics); index.js fetches the ICS, parses DESCRIPTION fields, optionally base64-decodes them to a URL, appends /generate, and issues a GET whose JSON response is returned to callers. This is a dead-drop command-and-control pattern in which the next-hop endpoint is rotated by editing calendar events, defeating static URL blocklists. The lookalike name imitates Akamai's sensor product but the package is not affiliated with Akamai.

Malicious versions

1 flagged

1.0.0

Indicators of compromise (SHA-256)

bfc0d67815042459dd2e8c526215eb8e204e0b62ae97438b320c0bd0a69a2ddf

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for akamai-sensorv1 (version 1.0.0). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging akamai-sensorv1 across your stack and pipelines.
If you installed it — respond
akamai-sensorv1 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If akamai-sensorv1 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks akamai-sensorv1 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. akamai-sensorv1 on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-015801

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks akamai-sensorv1-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database